CVE-2026-49428
Last modified
CVE-2026-49428 is a high-severity vulnerability rated 8.4/10 on the CVSS scale. Certain system calls, such open(2) with the O_TRUNC flag set, and fspacectl(2), could incorrectly free memory in largepage objects. These operations are not permitted on largepage objects, but the implementation did not verify this. An unprivileged local user can abuse the bug to access freed kernel memory. EPSS estimates a 0.29% chance of exploitation in the next 30 days.
Description
Certain system calls, such open(2) with the O_TRUNC flag set, and fspacectl(2), could incorrectly free memory in largepage objects. These operations are not permitted on largepage objects, but the implementation did not verify this. An unprivileged local user can abuse the bug to access freed kernel memory. This can be exploited to escalate privileges.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Freebsd | Freebsd | 14.3 |
| Freebsd | Freebsd | 14.4 |
| Freebsd | Freebsd | 15.0 |
| Freebsd | Freebsd | 15.1 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-49428?
How severe is CVE-2026-49428?
How do I fix CVE-2026-49428?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-49422The RACK setsockopt(2) handler drops the connection lock in …8.4
- CVE-2026-49423When building the iovec array for a received TLS 1.2 CBC rec…3.3
- CVE-2026-49424The Linux waitid() implementation translates a FreeBSD sigin…5.5
- CVE-2026-49425The compat32 kevent() handler translates a 64-bit kevent str…5.5
- CVE-2026-49426When auditing a system call executed via ptrace(PT_SC_REMOTE…3.3
- CVE-2026-49427Pages belonging to largepage shared memory objects were not …8.8
- CVE-2026-49429The ZFS_IOC_USERSPACE_MANY ioctl, used by zfs-userspace(8), …7.8
- CVE-2026-49430The ZFS_IOC_RECV_NEW ioctl, in the heal receive path, simila…7.8
- CVE-2026-49431The ZFS_IOC_SET_PROP ioctl, used by zfs-set(8), incorrectly …3.3
- CVE-2026-49432Improper Input Validation vulnerability in Apache ActiveMQ, …7.5
- CVE-2026-49433The DeepAI endpoint 'https://api.deepai.org/change_user_emai…5
- CVE-2026-49434Improper Input Validation vulnerability in Apache ActiveMQ B…7.5
Are you affected by CVE-2026-49428?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST